Chainalysis Breach Exposes All Users' Credentials
Chainalysis Breach Exposes All Users’ Credentials 🚨
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into a cyber attack targeting its systems has exposed names, usernames, password hashes, and live tokens for all users. “While we investigated, we removed access to Reactor and Data Solutions,” the company stated.
At this time, there is no evidence that any investigation data has been accessed or that Chainalysis attribution data has been manipulated. Chainalysis has implemented additional proactive monitoring systems to detect unusual activity, and has taken the Know Your Transaction (KYT) user interface and API offline, along with other address screening products and the login page.
Previously, Chainalysis described the situation as an “ongoing multi-front cyber attack,” leading to the discovery of an “on-path attack” that exposed a subset of customer passwords. The company has since addressed the attack vector.
Out of an abundance of caution, Chainalysis has locked the impacted accounts. “For customers who just received an email from us instructing you to reset your Chainalysis password, resetting this password won’t be possible right now,” it noted. “We still encourage you, where necessary, to reset your password on other systems where you may be reusing credentials.”
This development comes less than a week after Chainalysis reported a cybersecurity incident in which an external actor leveraged offensive techniques to gain unauthorized access to its systems and internal tools. The company intends to begin restoring access to KYT and Address Screening, urging customers to contact its support email or their Chainalysis account team with trusted IP addresses, which will be added to an allowlist. From there, users can reset their passwords and rotate API keys to register transactions. “We will require additional protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate.”
It’s unclear who is behind the attack, but Chainalysis notes it is similar to many other tech platforms targeted in recent weeks.
Indeed, several companies, including Chainstack, OpenCode, Warp, and WorkOS, have disclosed that they have been targeted by AI-driven attacks, some involving an autonomous penetration testing tool called ARTEX. According to Microsoft, threat actors are using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, such as credentials and API keys, to conduct follow-on attacks. “Agentic tooling like ARTEX allows threat actors to scan for secrets across multiple repositories at a quicker pace and analyze the output to conduct follow-on attacks, reducing the need for hands-on-keyboard interactions throughout the attack chain,” the tech giant stated. In at least one case, an AI agent is said to have progressed from scanning GitHub for secrets to exfiltrating data from Azure Key Vault in just five minutes. The activity is assessed to be ongoing since August 2026.